Verify session in gitlab-rails for terminal

internal/terminal/terminal.go

@@ -21,11 +21,18 @@ import (
 	"net/http"
 	"os/exec"
+	"gitlab.com/gitlab-org/gitlab-workhorse/internal/api"
+
 	"github.com/kr/pty"
 	"golang.org/x/net/websocket"
 )
-var Handler = http.HandlerFunc(handleFunc)
+func Handler(myAPI *api.API) http.Handler {
+	return myAPI.PreAuthorizeHandler(func(w http.ResponseWriter, r *http.Request, a *api.Response) {
+		// TODO: get namespace/pod/container from the API response
+		handleFunc(w, r)
+	}, "authorize")
+}
 // GET /shell handler
 // Launches /bin/bash and starts serving it via the terminal

internal/upstream/routes.go

@@ -71,7 +71,7 @@ func (u *Upstream) configureRoutes() {
 		route{"POST", regexp.MustCompile(ciAPIPattern + `v1/builds/[0-9]+/artifacts\z`), contentEncodingHandler(artifacts.UploadArtifacts(api, proxy))},
 		route{"", regexp.MustCompile(projectPattern + `deployments/[0-9]+/terminal_websocket\z`), NotFoundUnless(u.WebsocketTerminalEnabled,
-			terminal.Handler,
+			terminal.Handler(api),
 		)},
 		// Explicitly proxy API requests